I've been receiving lots of similar Spam. Where would I find this "x-lookup-ip extension" that I might try it too.
Thanks, Eric Johnson [EMAIL PROTECTED] July 27, 2006 2:15 AM (CST) -0600 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: July 26, 2006 8:54 PM To: Eric A. Silver Cc: [email protected] Subject: Re: [Spambayes] Spam Clues: [Bulk] Re: wegeoVjlAGRA Eric> This message was classified as "junk suspects." It appears to be Eric> identical to dozens of message that have come over the past Eric> several months, all of which I have moved from junk suspects to Eric> the junk folder. It appears that the training feature isn't Eric> working, despite the fact that it's checked. Any ideas? If you look at the clues there are few strong spam clues. The most important spam clue is the URL you are supposed to click. Unfortunately, the domain changes frequently. It's unlikely you'll see the same one more than once or twice. Any new domain will be unknown, thus unused. I've been using Matt Cowles' x-lookup-ip extension for several days, precisely to combat these spams. While all those domains are different, they all resolve to the same IP address. Using Matt's extension I get a lot of spammy clues: % spamcounts -r :211 Loading state from /Users/skip/hammie.db (hammie.db) database hammie.db is an existing ZODB, with 38 ham and 127 spam token,nspam,nham,spam prob url-ip:211.144.69/24,2,0,0.908163265306 received:211.160.160.49,1,0,0.844827586207 received:211.160,1,0,0.844827586207 received:211,2,0,0.908163265306 url-ip:211.47/16,1,0,0.844827586207 url-ip:211.144/16,6,0,0.96511627907 url-ip:211.115/16,1,0,0.844827586207 received:211.210.242.58,1,0,0.844827586207 url-ip:211.115.108/24,1,0,0.844827586207 url-ip:211.115.97.43/32,1,0,0.844827586207 url-ip:211.115.99.161/32,1,0,0.844827586207 url-ip:211.47.67.16/32,1,0,0.844827586207 url-ip:211.115.101/24,1,0,0.844827586207 url-ip:211.115.97.44/32,1,0,0.844827586207 url-ip:211.144.68.67/32,4,0,0.949438202247 url-ip:211.115.97/24,1,0,0.844827586207 received:211.210,1,0,0.844827586207 url-ip:211.144.68/24,4,0,0.949438202247 url-ip:211.115.99/24,1,0,0.844827586207 received:211.160.160,1,0,0.844827586207 url-ip:211.189.18/24,1,0,0.844827586207 url-ip:211.115.108.104/32,1,0,0.844827586207 received:211.210.242,1,0,0.844827586207 url-ip:211.144.69.244/32,2,0,0.908163265306 url-ip:211.189.18.186/32,1,0,0.844827586207 url-ip:211.115.108.103/32,1,0,0.844827586207 url-ip:211/8,8,0,0.973372781065 url-ip:211.47.67/24,1,0,0.844827586207 url-ip:211.115.101.228/32,1,0,0.844827586207 url-ip:211.189/16,1,0,0.844827586207 Note that www.tikerandevali.com also maps to 211.144.68.87. Skip _______________________________________________ [email protected] http://mail.python.org/mailman/listinfo/spambayes Check the FAQ before asking: http://spambayes.sf.net/faq.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.10.4/401 - Release Date: 26/07/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.10.4/401 - Release Date: 26/07/2006 _______________________________________________ [email protected] http://mail.python.org/mailman/listinfo/spambayes Check the FAQ before asking: http://spambayes.sf.net/faq.html
